All works except of ouput chain / ping timeout - How to troubleshoot?

RouterOS Beginner Basics
1

I have hEX S. Just updated with 7.1.3, but the issue is there for a few years now. All routing works great. Clients can connect, traffic is forwarded, etc. However, connections from the hEX itself (output chain?) can’t go out. For example, ping from hEX console to 1.1.1.1 or 9.9.9.9 times-out. But I can ping LAN machines without any problem, though.
I don’t have any firewall filter rules on “output” chain. Adding “accept all” on “output” chain doesn’t make any difference either. So I guess it’s a not a firewall issue, (or is it)?
Where to look next, please? I am looking for some guidance how to troublehoot such silly “problems”. Thank you in advance!

[admin@HEXS] > ping 1.1.1.1
  SEQ HOST                                     SIZE TTL TIME       STATUS                                 
    0 1.1.1.1                                                      timeout                                
    1 1.1.1.1                                                      timeout                                
    2 1.1.1.1                                                      timeout                                
    3 1.1.1.1                                                      timeout                                
    4 1.1.1.1                                                      timeout                                
    5 1.1.1.1                                                      timeout                                
    sent=6 received=0 packet-loss=100%
2

Betcha there is something blocking it. I just tried it on the RB4011 that I am connected to. Worked fine. Post your config so we all can take a look.

To export and paste your configuration (and I’m assuming you are using WebFig or Winbox), open a terminal window, and type (without the quotes) “/export hide-sensitive file=any-filename-you-wish”. Then open the files section and right click on the filename you created and select download in order to download the file to your computer. It will be a text file with whatever name you saved to with an extension of .rsc. Then in your message here, click the code display icon in the toolbar above the text entry (the code display icon is the 7th one from the left and looks like a square with a blob in the middle). Then paste the text from the file in between the two code words in brackets.

3

Or responses can’t go in. You can see what happens with outgoing packets using either Tools->Torch or logging rules like:

/ip firewall mangle
add chain=output dst-address=1.1.1.1 action=log
add chain=postrouting dst-address=1.1.1.1 action=log

And similar for responses:

/ip firewall mangle
add chain=prerouting src-address=1.1.1.1 action=log
add chain=input src-address=1.1.1.1 action=log

Move all these rules at the beginning of chains and test what happens.